# Cloud NAT Module
Simple Cloud NAT management, with optional router creation.
- [Basic Example](#basic-example)
- [Subnetwork configuration](#subnetwork-configuration)
- [Reserved IPs and custom rules](#reserved-ips-and-custom-rules)
- [Hybrid NAT](#hybrid-nat)
- [Variables](#variables)
- [Outputs](#outputs)
## Basic Example
```hcl
module "nat" {
source = "./fabric/modules/net-cloudnat"
project_id = var.project_id
region = var.region
name = "default"
router_network = var.vpc.self_link
}
# tftest modules=1 resources=2 e2e
```
## Subnetwork configuration
Subnetwork configuration is defined via the `config_source_subnetworks` variable:
- the default is to configure all ranges for all subnets
- to only configure primary ranges set `config_source_subnetworks.primary_ranges_only` to `true`
- to specify a list of subnets set `config_source_subnetworks.all` to `false` and provide a list of subnets in `config_source_subnetworks.subnetworks`
When specifying subnets the default for IP ranges is to consider all ranges (primary and secondaries). More control can be obtained via the `all` subnetwork attribute: when set to `false` only the primary subnet range is considered, unless secondary ranges are specified via the `secondary_ranges` attribute.
```hcl
module "nat" {
source = "./fabric/modules/net-cloudnat"
project_id = var.project_id
region = var.region
name = "default"
router_network = var.vpc.self_link
config_source_subnetworks = {
all = false
subnetworks = [
{
# all ip ranges
self_link = "projects/${var.project_id}/regions/${var.region}/subnetworks/net-0"
},
{
# primary range only
self_link = "projects/${var.project_id}/regions/${var.region}/subnetworks/net-1"
all_ranges = false
},
{
# both primary and specified secondary ranges
self_link = "projects/${var.project_id}/regions/${var.region}/subnetworks/net-2"
all_ranges = false
secondary_ranges = ["pods"]
}
]
}
}
# tftest modules=1 resources=2
```
## Reserved IPs and custom rules
```hcl
module "addresses" {
source = "./fabric/modules/net-address"
project_id = var.project_id
external_addresses = {
a1 = { region = var.region }
a2 = { region = var.region }
a3 = { region = var.region }
}
}
module "nat" {
source = "./fabric/modules/net-cloudnat"
project_id = var.project_id
region = var.region
name = "nat"
router_network = var.vpc.self_link
addresses = [
module.addresses.external_addresses["a1"].self_link,
module.addresses.external_addresses["a3"].self_link
]
config_port_allocation = {
enable_endpoint_independent_mapping = false
}
rules = [
{
description = "rule1"
match = "destination.ip == '8.8.8.8'"
source_ips = [
module.addresses.external_addresses["a2"].self_link
]
}
]
}
# tftest modules=2 resources=5 inventory=rules.yaml e2e
```
## Hybrid NAT
```hcl
module "vpc1" {
source = "./fabric/modules/net-vpc"
project_id = var.project_id
name = "vpc1"
subnets = [
{
ip_cidr_range = "10.0.0.0/24"
name = "vpc1-subnet"
region = var.region
}
]
subnets_private_nat = [
{
ip_cidr_range = "192.168.15.0/24"
name = "vpc1-nat"
region = var.region
}
]
}
module "vpc1-nat" {
source = "./fabric/modules/net-cloudnat"
project_id = var.project_id
region = var.region
name = "vpc1-nat"
type = "PRIVATE"
router_network = module.vpc1.id
config_source_subnetworks = {
all = false
subnetworks = [
{
self_link = module.vpc1.subnet_ids["${var.region}/vpc1-subnet"]
}
]
}
config_port_allocation = {
enable_endpoint_independent_mapping = false
enable_dynamic_port_allocation = true
}
rules = [
{
description = "private nat"
match = "nexthop.is_hybrid"
source_ranges = [
module.vpc1.subnets_private_nat["${var.region}/vpc1-nat"].id
]
}
]
}
# tftest modules=2 resources=7 inventory=hybrid.yaml
```
## Variables
| name | description | type | required | default |
|---|---|:---:|:---:|:---:|
| [name](variables.tf#L77) | Name of the Cloud NAT resource. | string | ✓ | |
| [project_id](variables.tf#L82) | Project where resources will be created. | string | ✓ | |
| [region](variables.tf#L87) | Region where resources will be created. | string | ✓ | |
| [addresses](variables.tf#L17) | Optional list of external address self links. | list(string) | | [] |
| [config_port_allocation](variables.tf#L23) | Configuration for how to assign ports to virtual machines. min_ports_per_vm and max_ports_per_vm have no effect unless enable_dynamic_port_allocation is set to 'true'. | object({…}) | | {} |
| [config_source_subnetworks](variables.tf#L39) | Subnetwork configuration. | object({…}) | | {} |
| [config_timeouts](variables.tf#L58) | Timeout configurations. | object({…}) | | {} |
| [logging_filter](variables.tf#L71) | Enables logging if not null, value is one of 'ERRORS_ONLY', 'TRANSLATIONS_ONLY', 'ALL'. | string | | null |
| [router_asn](variables.tf#L92) | Router ASN used for auto-created router. | number | | null |
| [router_create](variables.tf#L98) | Create router. | bool | | true |
| [router_name](variables.tf#L104) | Router name, leave blank if router will be created to use auto generated name. | string | | null |
| [router_network](variables.tf#L110) | Name of the VPC used for auto-created router. | string | | null |
| [rules](variables.tf#L116) | List of rules associated with this NAT. | list(object({…})) | | [] |
| [type](variables.tf#L136) | Whether this Cloud NAT is used for public or private IP translation. One of 'PUBLIC' or 'PRIVATE'. | string | | "PUBLIC" |
## Outputs
| name | description | sensitive |
|---|---|:---:|
| [id](outputs.tf#L17) | Fully qualified NAT (router) id. | |
| [name](outputs.tf#L22) | Name of the Cloud NAT. | |
| [nat_ip_allocate_option](outputs.tf#L27) | NAT IP allocation mode. | |
| [region](outputs.tf#L32) | Cloud NAT region. | |
| [router](outputs.tf#L37) | Cloud NAT router resources (if auto created). | |
| [router_name](outputs.tf#L46) | Cloud NAT router name. | |